Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.4

kin-openapi may let unauthenticated users reach protected endpoint

CVE-2026-100351 · published 20 days ago
Summary

Versions of the kin-openapi library (0.144.0 through 0.147.0) can misinterpret encoded URLs, causing a request that looks public to be routed to a protected handler without running the required authentication check. This can allow an attacker to bypass access controls on certain API paths. Upgrade to version 0.147.0 or later to resolve the issue.

What to do
  • Update github.com getkin to version 0.147.0.
  • Update getkin github.com/getkin/kin-openapi to version 0.147.0.
Affected software
Ecosystem VendorProductAffected versions
– getkin kin-openapi >= 0.144.0, < 0.147.0
go github.com getkin >= 0.144.0, < 0.147.0
Fix: upgrade to 0.147.0
Ubuntu:22.04:LTS canonical golang-github-getkin-kin-openapi All versions
Go getkin github.com/getkin/kin-openapi >= 0.144.0, < 0.147.0
Fix: upgrade to 0.147.0
Original advisory text
kin-openapi: ValidationHandler security-requirement bypass via encoded-path operation confusion
kin-openapi is a Go project for handling OpenAPI files. From 0.144.0 until 0.147.0, openapi3filter.ValidationHandler validates an operation selected from decoded URL.Path while a downstream gorilla/mux router configured with UseEncodedPath can dispatch a different operation selected from URL.RawPath. When a public exact route and a protected parameterized route use the same method and overlap after decoding, an unauthenticated remote request containing an encoded path separator can be validated as public and then dispatched to the protected handler without invoking the configured AuthenticationFunc. The reachable path parameter is constrained to an encoded representation that decodes to the public literal route, and proxies that canonicalize the URI before forwarding prevent this specific mismatch. This issue is fixed in version 0.147.0.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
7.4 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-289Authentication Bypass by Alternate Name
CWE-436Interpretation Conflict
Timeline
Published15 Oct 2026
Updated4 Nov 2026
First seen15 Oct 2026
Sources
CVE-2026-100351 · NVD
CVE-2026-100351 · MITRE
GHSA-23vg-4cjm-66q5 · GHSA
CVE-2026-100351 · OSV
UBUNTU-CVE-2026-100351 · OSV
GHSA-23vg-4cjm-66q5 · OSV
Track software like this
Free during beta